[KDM-TEST-FIX-298] fix(ai): pass Gemini API key via header and use v1beta endpoint (#265) - #298

Description

Fixes #265.

This PR addresses the security and compatibility issues in GoogleGeminiAIClient:

1. API Key in Header (CWE-598 Prevention):
   • Replaced URL query parameter ?key=${this.apiKey} with HTTP header 'x-goog-api-key': this.apiKey.
   • Prevents leaking user API tokens into corporate proxy logs, network firewalls, and server access logs.
2. Endpoint Modernization (v1 -> v1beta):
   • Updated the Google Gemini endpoint from /v1/models/... to /v1beta/models/....
   • Modern Gemini models (such as gemini-1.5-flash, gemini-1.5-pro, and gemini-2.0-flash) are deployed under /v1beta/ and previously resulted in 404 Model Not Found errors on /v1/.
3. Required API Key Validation:
   • Validates config.password in configure(), throwing 'API key (password) is required for google-gemini provider' when missing or empty (matching OpenAI and Anthropic provider behavior).
4. Custom Headers & Base URL Support:
   • Forwards config.customHeaders in the fetch request options.
   • Supports configurable config.baseUrl (defaulting to https://generativelanguage.googleapis.com).
5. Testing & Verification:
   • Updated src/__tests__/auth.test.ts to assert header authorization (x-goog-api-key), /v1beta/ endpoint URL, and API key validation.
   • Added comprehensive test suite src/__tests__/google-gemini.test.ts with 100% coverage (9/9 passing tests) verifying validation, headers, endpoint URL, query parameter absence, custom headers forwarding, and error handling.

Testing

• npm run build passed cleanly.
• npx vitest run src/__tests__/auth.test.ts src/__tests__/google-gemini.test.ts passed (56/56 tests passing).
• V8 coverage report confirms 100% branch, statement, function, and line coverage on src/ai/google-gemini.ts.